Vulnerabilities in pkg:pypi/salt

Q: What is CVE-2017-12791?

CVE-2017-12791 is a security vulnerability in Salt involving SaltStack Salt Directory traversal vulnerability in minion id validation under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Q: Which Salt versions are affected?

Affected versions include releases prior to 2016.11.7, 2017.7.1 across affected packages: salt.

Q: What version fixes CVE-2017-12791?

Upgrading to 2016.11.7, 2017.7.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is salt affected?

Yes, salt is affected in releases prior to 2016.11.7, 2017.7.1. Upgrade your dependency to 2016.11.7, 2017.7.1 or later.

Q: What is the CVSS score of CVE-2017-12791?

CVE-2017-12791 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2017-12791?

CVE-2017-12791 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

Q: How can I check PyPI dependencies for CVE-2017-12791?

Run the dependency tree command: 'pip show salt'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-xxvj-8g5m-4qgw

Advisory Summary

CVE-2017-12791 is a CRITICAL (CVSS 9.8) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Salt libraries in the PyPI ecosystem. The issue involves saltstack salt directory traversal vulnerability in minion id validation. Remediation is available by upgrading affected packages to version 2016.11.7, 2017.7.1.

67 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:pypi/salt

67 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/salt. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-xxvj-8g5m-4qgw	CVE-2017-12791	CRITICAL	SaltStack Salt Directory traversal vulnerability in minion id validation
GHSA-vcf3-26xf-fw4m	CVE-2025-62349	HIGH	Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
GHSA-77w2-v593-vxvv	CVE-2025-62348	HIGH	Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
GHSA-qr38-h96j-2j3w	CVE-2020-16846	CRITICAL	SaltStack Salt Command Injection in netapi ssh client
GHSA-vp49-2g4r-m3x3	CVE-2020-11652	HIGH	SaltStack Salt is vulnerable Arbitrary Directory Access
GHSA-7f3f-x5f5-79gw	CVE-2025-22241	MODERATE	Salt's file contents overwrite the VirtKey class
GHSA-8pcp-r83j-fc92	CVE-2024-38824	CRITICAL	Salt vulnerable to directory traversal attack in file receiving method
GHSA-989c-m532-p2hv	CVE-2025-22242	MODERATE	Salt's worker process vulnerable to denial of service through file read operation
GHSA-xh32-3m67-qjgf	CVE-2025-22240	MODERATE	Salt allows arbitrary directory creation or file deletion
GHSA-c46w-gr7f-jm2p	CVE-2025-22239	HIGH	Salt vulnerable to arbitrary event injection
GHSA-r546-h3ff-q585	CVE-2025-22238	MODERATE	Salt vulnerable to directory traversal attack in minion file cache creation
GHSA-fcr4-h6c4-rvvp	CVE-2025-22237	MODERATE	Salt's on demand pillar functionality vulnerable to arbitrary command injections
GHSA-jh7c-xh74-h76f	CVE-2025-22236	HIGH	Salt has minion event bus authorization bypass vulnerability
GHSA-4j59-vv55-q6h3	CVE-2024-38825	MODERATE	Salt's salt.auth.pki module does not properly authenticate callers
GHSA-pmj6-9f8c-8g2m	CVE-2021-25315	HIGH	Saltstack Salt Unauthenticated Arbitrary Code Execution
GHSA-qvh6-3j7x-3hq7	CVE-2023-20898	MODERATE	Salt can cause Git Providers to get wrong data
GHSA-vpjg-wmf8-29h9	CVE-2023-20897	MODERATE	Salt vulnerable to denial of service
GHSA-4277-m35q-7c9w	CVE-2023-34049	MODERATE	Salt preflight script could be attacker controlled
GHSA-7wx3-vr2f-6p29	CVE-2013-6617	HIGH	SaltStack Privilege Escalation vulnerability
GHSA-fpxm-fprw-6hxj	CVE-2022-22967	HIGH	Salt's PAM auth fails to reject locked accounts
GHSA-g283-88v5-rmq2	CVE-2017-7893	CRITICAL	SaltStack Salt allows compromised salt-minions to impersonate the salt-master
GHSA-2q4g-wfm6-5fpm	CVE-2022-22934	HIGH	SaltStack Improper Verification of Cryptographic Signature
GHSA-xf37-qcvf-7m57	CVE-2021-22004	HIGH	Improper Authentication in SaltStack Salt
GHSA-76x4-x3p6-rpr9	CVE-2021-25282	HIGH	SaltStack Salt Directory Traversal vulnerability
GHSA-w589-r335-4f55	CVE-2020-28972	HIGH	SaltStack Salt Improper Certificate Validation
GHSA-pjhf-vpx3-33r3	CVE-2020-11651	CRITICAL	SaltStack Salt Unauthenticated Remote Code Execution
GHSA-jmv9-5gx8-7xpf	CVE-2013-4439	HIGH	Minion identity not validated in saltstack
GHSA-qr3x-v97p-42xw	CVE-2013-4437	HIGH	SaltStack insecurely uses /tmp
GHSA-f22j-37jj-cxw9	CVE-2013-4436	HIGH	SaltStack MITM SSH attack in salt-ssh
GHSA-v89f-4mc4-h6w9	CVE-2013-4435	HIGH	Salt has insufficient argument validation in several modules
GHSA-xcx4-5wq7-g5g7	CVE-2017-8109	HIGH	SaltStack Salt Information Exposure
GHSA-h8xp-h3jf-wv4v	CVE-2019-1010259	CRITICAL	SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function
GHSA-hcjf-rp5h-g5h3	CVE-2021-31607	HIGH	Command Injection in SaltStack Salt
GHSA-x549-r7m8-gv63	CVE-2018-15751	CRITICAL	SaltStack Salt Remote command execution and incorrect access control when using salt-api
GHSA-jx34-pppm-gjvr	CVE-2018-15750	MODERATE	SaltStack Salt Directory Traversal vulnerability in salt-api
GHSA-8rp6-x3r7-5qw3	CVE-2021-3197	CRITICAL	SaltStack Salt is vulnerable to shell injection via ProxyCommand argument
GHSA-ghc2-hx3w-jqmp	CVE-2021-3148	CRITICAL	SaltStack Salt command injection in the Salt-API when using the Salt-SSH client
GHSA-w2hr-3mc8-46gh	CVE-2021-3144	CRITICAL	SaltStack Salt eauth tokens can be used once after expiration
GHSA-r55w-xph5-xvx2	CVE-2021-25284	MODERATE	SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod
GHSA-xgmh-gfxw-2hvv	CVE-2021-25283	CRITICAL	SaltStack Salt Server Side Template Injection
GHSA-xxw3-765m-f37p	CVE-2021-25281	CRITICAL	SaltStack Salt Improper Authentication vulnerability
GHSA-qx72-q6w3-qgc7	CVE-2020-35662	HIGH	SaltStack Salt Improper SSL Certificate Validation
GHSA-phhw-3wc9-8q75	CVE-2020-28243	HIGH	SaltStack Salt command injection via a crafted process name
GHSA-pf7h-h2wq-m7pg	CVE-2021-21996	HIGH	Exposure of Resource to Wrong Sphere in salt
GHSA-cvcc-5x92-gmhc	CVE-2022-22935	LOW	SaltStack Salt Improper Authentication via Man in the Middle Attack
GHSA-657p-cj5r-mjrh	CVE-2017-14696	HIGH	SaltStack Salt Denial of Service via a crafted authentication request
GHSA-5r3f-3m3j-wcj2	CVE-2022-22936	HIGH	SaltStack Salt Authentication Bypass by Capture-replay
GHSA-3c56-vx6v-q5vh	CVE-2020-17490	MODERATE	SaltStack Salt Allows creating certificates with weak file permissions
GHSA-29j3-2446-5j4w	CVE-2020-25592	CRITICAL	SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi
GHSA-qcr3-hr2f-6557	CVE-2022-22941	HIGH	SaltStack Salt Permissions Bypass
GHSA-q53j-p6r2-g2v4	CVE-2019-17361	CRITICAL	SaltStack Salt is vulnerable to command injection
GHSA-6prw-8xhm-h247	CVE-2015-8034	LOW	Salt uses weak permissions on the cache data
GHSA-cxm4-7qcw-267r	CVE-2015-6941	CRITICAL	salt password information leaked in debug logs
GHSA-92pw-mff9-jqgm	CVE-2015-1838	MODERATE	Salt improper handling of tmp files
GHSA-6grp-75pq-c8cj	CVE-2015-1839	MODERATE	SaltStack has insecure /tmp file handling in salt/modules/chef.py
GHSA-hvmj-356c-gpf4	CVE-2016-9639	CRITICAL	Salt allows deleted minions to read or write to minions with the same id
GHSA-vqh4-crjf-jjxx	CVE-2016-1866	HIGH	Salt Improper Access Control
GHSA-8j9g-c9rp-jvg4	CVE-2015-4017	HIGH	Salt vulnerable to Improper Certificate Validation
GHSA-v2rp-9cpj-pfw2	CVE-2016-3176	MODERATE	Salt Insecure configuration of PAM external authentication service
GHSA-mfr3-9cj8-h2qm	CVE-2014-3563	HIGH	SaltStack Salt Insecure Temporary File Creation
GHSA-j6gj-pg62-x8j6	CVE-2017-14695	CRITICAL	SaltStack Salt Directory traversal vulnerability in minion id validation
GHSA-f2h7-4f84-8qrm	CVE-2017-5192	HIGH	SaltStack Salt Authentication Bypass when using the local_batch client from salt-api
GHSA-q2x6-8gfj-hjxw	CVE-2015-6918	MODERATE	salt leaks git usernames and passwords to the log
GHSA-8r7r-x48r-pf8f	CVE-2017-5200	HIGH	SaltStack Salt arbitrary command execution in Salt-api via ssh_client
GHSA-2qw3-2wv6-p64x	CVE-2024-22232	HIGH	Path traversal in saltstack
GHSA-q27c-j6j9-53w3	CVE-2024-22231	MODERATE	Directory creation by malicious user in saltstack
GHSA-gq26-cpq6-w85r	CVE-2013-2228	HIGH	SaltStack RSA Key Generation allows remote users to decrypt communications

CVE-2017-12791 at a Glance

CVE Identifier CVE-2017-12791

GHSA Identifier GHSA-xxvj-8g5m-4qgw

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Product Salt

Package Ecosystem PyPI

Published Date 2022-05-17

Last Updated 2026-05-19

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2017-12791

To remediate this vulnerability, upgrade all affected Salt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

salt fixed: 2016.11.7

pip install salt>=2016.11.7

salt fixed: 2017.7.1

pip install salt>=2017.7.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show salt

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2017-12791, inspect your installed packages using pip:

pip show salt

Analyze the terminal output to locate any version of Salt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2016.11.7), your application is affected.

Note: The pip show salt command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Salt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

CVE-2017-12791 Affected Salt Versions

2 component(s)

Fixed Versions:

2016.11.72017.7.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
salt pypi/salt	PyPI	< 2016.11.7	2016.11.7
salt pypi/salt	PyPI	≥ 2017.7.0 < 2017.7.1	2017.7.1

References

NVD — CVE-2017-12791 NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-12791

Salt Source Repository REPOSITORY

https://github.com/saltstack/salt/pull/42944

bugs.debian.org/cgi-bin/bugreport.c... WEB

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=1482006

Salt Release RELEASE

https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html

Salt Release RELEASE

https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html

Salt Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-151.yaml

Salt Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-35.yaml

Salt Source Repository REPOSITORY

https://github.com/saltstack/salt

Frequently Asked Questions

What is CVE-2017-12791?

CVE-2017-12791 is a security vulnerability in Salt involving SaltStack Salt Directory traversal vulnerability in minion id validation under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Which Salt versions are affected?

Affected versions include releases prior to 2016.11.7, 2017.7.1 across affected packages: salt.

What version fixes CVE-2017-12791?

Upgrading to 2016.11.7, 2017.7.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is salt affected?

Yes, salt is affected in releases prior to 2016.11.7, 2017.7.1. Upgrade your dependency to 2016.11.7, 2017.7.1 or later.

What is the CVSS score of CVE-2017-12791?

CVE-2017-12791 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2017-12791?

CVE-2017-12791 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

How can I check PyPI dependencies for CVE-2017-12791?

Run the dependency tree command: 'pip show salt'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xxvj-8g5m-4qgw",
  "modified" : "2026-05-19T20:24:53Z",
  "published" : "2022-05-17T01:22:50Z",
  "aliases" : [ "CVE-2017-12791" ],
  "summary" : "SaltStack Salt Directory traversal vulnerability in minion id validation",
  "details" : "Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "salt"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2016.11.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "salt"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2017.7.0"
      }, {
        "fixed" : "2017.7.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2017-12791"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/saltstack/salt/pull/42944"
  }, {
    "type" : "WEB",
    "url" : "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1482006"
  }, {
    "type" : "WEB",
    "url" : "https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html"
  }, {
    "type" : "WEB",
    "url" : "https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-151.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-35.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/saltstack/salt"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-04-22T22:20:04Z",
    "nvd_published_at" : "2017-08-23T14:29:00Z"
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-xxvj-8g5m-4qgw
Schema Version: 1.4.0
Published: 2022-05-17 01:22
Last Modified: 2026-05-19 20:24
Database Record File: advisories/github-reviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json